Privacypolicy

UCN Hub is the software studio operated by UCNHUB LLC, a limited liability company formed under the laws of the State of Delaware, United States. Where this policy says “we”, “us”, or “UCN Hub”, it means UCNHUB LLC.

For the personal data described here, UCNHUB LLC is the entity that decides why and how it is processed, except during a client engagement where we act on your instructions — see Our Two Roles.

We have not appointed a Data Protection Officer, as we are not required to. Privacy questions go to the address below and are handled by the people who run the company.

Legal entity

UCNHUB LLC

Entity type

Delaware limited liability company

File number

10710550

Registered office

254 Chapman Rd, Suite 101-B
Newark, DE 19702, United States

Privacy contact

[email protected]

This policy applies to ucnhub.com and its subdomains: the pages you read, the enquiry form you may send us, and the correspondence that follows.

It is deliberately narrow, because this site is narrow. There are no user accounts, no dashboard, no payments taken on the site, and nothing for you to log into.

Data protection law separates the party that decides why data is processed (the controller) from the party that processes it on someone else's instructions (the processor). We are both, depending on the context.

We collect very little, because a marketing site with one form does not need much. Everything we hold falls into the categories below.

Much of what a privacy policy usually has to explain simply does not happen here. To be unambiguous about it:

• No analytics — there is no Google Analytics, no Tag Manager, and no other measurement tool running on this site
• No advertising or tracking pixels, and no cross-site tracking of any kind
• No accounts or passwords — there is nothing on this site to sign in to
• No payment data — the site takes no payments; client invoicing happens by bank transfer outside the site
• No data brokers — we do not buy personal data, enrich records with purchased information, or append firmographic data to your enquiry
• No sale of personal data, and no sharing of it for cross-context behavioural advertising
• No newsletter or marketing list — we do not add you to a mailing list because you sent us a brief
• No special category data is requested at any point; please do not put health, biometric, political, religious, or similar information into the brief

• Answering your enquiry — reading your brief, replying to it, and having the follow-up conversation.
• Scoping and proposing work — turning a brief into an architecture, an estimate, and a Statement of Work.
• Delivering an engagement — communicating with your team and doing the work we were contracted to do.
• Business administration — invoicing, accounting, and keeping the records the law requires us to keep.
• Security and abuse prevention — rate-limiting the form, discarding automated submissions, and investigating misuse of the site.
• Legal compliance — meeting our tax and regulatory obligations and responding to lawful requests.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we must have a lawful basis for each purpose. Ours are:

• Steps prior to a contract, and performance of a contract (Art. 6(1)(b)) — answering your enquiry, preparing a proposal at your request, and then delivering and invoicing an engagement.
• Legitimate interests (Art. 6(1)(f)) — keeping the site available and free of abuse, retaining correspondence so we have a record of what was agreed, and holding engagement records for the ordinary running of the business. We have weighed these against your rights and collect the minimum each requires.
• Consent (Art. 6(1)(a)) — anything stored in your browser beyond what is strictly necessary. You give it through the banner and can withdraw it at any time, without affecting processing already carried out.
• Legal obligation (Art. 6(1)(c)) — retaining financial and tax records, and responding to valid legal process.

This site sets no cookies. The only thing stored in your browser is the record of your answer to the consent banner, kept in local storage and never sent to us.

Fonts and the consent manager are served from our own domain rather than a third-party CDN, so loading a page makes no request to any other company's servers.

During an engagement we may be given access to systems containing personal data about your customers, staff, or users. We treat that data as yours throughout.

We process it only on your documented instructions, only for the purposes of the engagement, and only by people who need it. Our staff and subcontractors are bound by confidentiality obligations that survive the engagement.

• Clients subject to the GDPR, UK GDPR, or a comparable regime should ask for a Data Processing Agreement before an engagement involving personal data begins
• We prefer to work against anonymised, masked, or synthetic data in development environments, and will ask for it wherever a project allows
• Access to production systems is requested only where necessary, used only for the engagement, and surrendered at handover
• At the end of an engagement we return or delete client data on request, subject to any retention the law requires of us

We do not sell personal data and we do not share it for advertising. Data reaches a third party only in the situations below.

We are a United States company and our records are held in the United States. If you are outside the US, sending us an enquiry involves transferring your data there.

The United States has not been the subject of a general adequacy decision covering all transfers. Where a transfer from the EEA or UK requires a safeguard, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where the UK GDPR applies, together with the additional measures appropriate to the small amount of data involved.

Our hosting provider operates a global edge network, so a page may be served to you from a location near you rather than from the United States. You can ask us for a copy of the transfer safeguards we rely on.

We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires.

We keep the attack surface small on purpose. A site with no database, no accounts, and no stored submissions has very little to lose in the first place — the enquiry form does not write to a database at all, it sends an email and forgets.

• The site is served over HTTPS, with traffic encrypted in transit
• Enquiry mail is submitted over an authenticated, TLS-protected SMTP connection
• Submissions are validated and length-limited, escaped before being rendered into the notification email, and stripped of line breaks that could be used to inject mail headers
• The form is rate-limited per IP address and screened for automated submission
• Mail credentials are held as runtime secrets and never reach the browser or the client bundle
• Access to the mailbox that receives enquiries is limited to the people who need it and protected by strong, unique credentials

If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where the risk to you is high, we will tell you directly and without undue delay, describing what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

Where we are acting as a processor for a client, we notify that client without undue delay so they can meet their own obligations, rather than notifying regulators or individuals ourselves.

If you are in the EEA, the UK, or Switzerland, the GDPR and UK GDPR give you the rights below. We extend the substance of them to everyone who writes to us, wherever they are, because operating two standards for a handful of records would be pointless.

• Access — a copy of the personal data we hold about you, and an explanation of what we do with it
• Rectification — correction of anything inaccurate or incomplete
• Erasure — deletion, where we have no overriding reason to keep it
• Restriction — a pause on processing while a dispute about accuracy or legitimate interests is resolved
• Portability — the data you gave us, in a structured, machine-readable format
• Objection — to processing based on legitimate interests, and absolutely to direct marketing
• Withdrawal of consent — at any time, without affecting processing already carried out

Residents of California and of other states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, and Texas — have rights to know, delete, correct, and obtain a portable copy of their personal information, and to be free from discrimination for exercising them.

We honour these requests through the same channel and the same timescales as the rights above.

This site is aimed at businesses and the people who run them. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

If you believe a child has sent us information through the enquiry form, tell us and we will delete it promptly.

We do not carry out profiling or automated decision-making that produces legal or similarly significant effects. A human reads every enquiry and a human decides whether we take a project on.

The only automation touching your submission is the anti-spam check and the rate limit, which may cause a submission to be discarded or delayed. If you think a legitimate enquiry was blocked, email us directly and it will reach us.

The site links to our profiles on LinkedIn, Facebook, and Telegram, to our office address on Google Maps, and to UCN Mail and UCN VPN. Following any of those links takes you somewhere governed by someone else's policy.

Nothing loads from those services while you are on our pages, and we receive no notification that you followed a link. We are not responsible for their content or their privacy practices.

We may update this policy as the site or the business changes. The “Last updated” date at the top always reflects the most recent revision.

Where a change materially affects how we use data we already hold about you, and we have a way to reach you, we will tell you directly rather than relying on you to re-read this page.

Questions about this policy, requests to exercise your rights, or anything else about how we handle personal data:

Entity

UCNHUB LLC

Address

254 Chapman Rd, Suite 101-B
Newark, DE 19702, United States

Privacy contact

[email protected]

Response time

Within 30 days, usually far sooner

Related

Cookie Policy · Terms & Conditions